# Webhooks

Create a subscription with `POST /hooks`. Atomicat sends an HTTP POST to `target_url` when the event happens.

```bash
curl -X POST "https://automation.atomicat-api.com/api/automation/v1/hooks" \
  -H "Authorization: Bearer $ATOMICAT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "target_url": "https://example.com/atomicat",
    "event_type": "form_lead.created"
  }'
```

The response includes the subscription `id`. It does not repeat the target URL. `DELETE /hooks/{subscriptionId}` turns the subscription off. Deliveries stop.

## Events

| `event_type` | When it is sent |
| --- | --- |
| `form_lead.created` | A form submission is stored |
| `quiz_lead.created` | A quiz submission is stored |
| `page.created` | A page is created |
| `page.published` | A page is published |
| `product.created` | A product is created |
| `funnel.created` | A funnel is created |
| `site.created` | A site is created |
| `project.created` | A project is created |

There is no `video.uploaded` event. After an upload in the Atomicat app, poll `GET /videos`.

`GET /hooks/sample/{eventType}` returns one example object inside an array. Use it to build the receiver before you subscribe.

## URL rules

`target_url` must be HTTPS on a public host. These are rejected:

- `http://` URLs
- URLs with a username or password
- `localhost`, `.local`, and `.internal`
- private, loopback, and link-local addresses, including cloud metadata addresses
- a hostname that resolves to one of those addresses

The host is checked again immediately before delivery.

## Receiver

Respond with a `2xx` status. Treat the body as JSON. The sample endpoint shows the fields for each event. Store the event `id` if you need to ignore a repeat delivery.